The correct answer is C. Column masks are the right tool when you need to partially expose sensitive data rather than hide it entirely. A column mask is a SQL function attached to a column that rewrites the returned value based on who is querying. For email_address, the mask returns only the substring after ' @ ' . For credit_card_number, it returns only the last four digits. Business analysts get useful data without seeing anything sensitive, and they can still query the table without errors.

Option A (row-level filters) controls which rows a user sees, not the values within a row — it can ' t partially redact a column. Option B (grant SELECT only on non-sensitive columns) removes the columns entirely, so analysts can ' t see even partial email or card values — that doesn ' t meet the ' can see only partial values ' requirement. Option D (column-level encryption) requires key management infrastructure and decryption at query time, which is significantly more complex than column masking for this use case.